volatility.plugins.overlays.windows.vad_vtypes.VadTraverser Class Reference

Inheritance diagram for volatility.plugins.overlays.windows.vad_vtypes.VadTraverser:

Public Member Functions
def	is_valid (self)
def	traverse
	Traverse the VAD tree by generating all the left items, then the right items. More...
Public Member Functions inherited from volatility.obj.CType
def	__init__ (self, theType, offset, vm, name=None, members=None, struct_size=0, kwargs)
	This must be instantiated with a dict of members. More...
def	size (self)
def	__repr__ (self)
def	d (self)
def	v (self)
	When a struct is evaluated we just return our offset.
def	m (self, attr)
def	__getattr__ (self, attr)
def	__setattr__ (self, attr, value)
	Change underlying members.
Public Member Functions inherited from volatility.obj.BaseObject
def	__init__ (self, theType, offset, vm, native_vm=None, parent=None, name=None, kwargs)
def	obj_type (self)
def	obj_vm (self)
def	obj_offset (self)
def	obj_parent (self)
def	obj_name (self)
def	obj_native_vm (self)
def	set_native_vm (self, native_vm)
	Sets the native_vm.
def	rebase (self, offset)
def	proxied (self, attr)
def	newattr (self, attr, value)
	Sets a new attribute after the object has been created.
def	write (self, value)
	Function for writing the object back to disk.
def	__getattr__ (self, attr)
	This is only useful for proper methods (not ones that start with __ )
def	__setattr__ (self, attr, value)
def	__nonzero__ (self)
	This method is called when we test the truth value of an Object. More...
def	__eq__ (self, other)
def	__ne__ (self, other)
def	__hash__ (self)
def	m (self, memname)
def	is_valid (self)
def	dereference (self)
def	dereference_as (self, derefType, kwargs)
def	cast (self, castString)
def	v (self)
	Do the actual reading and decoding of this member.
def	__format__ (self, formatspec)
def	__str__ (self)
def	__repr__ (self)
def	d (self)
	Display diagnostic information.
def	__getstate__ (self)
	This controls how we pickle and unpickle the objects.
def	__setstate__ (self, state)

Static Public Attributes
dictionary	tag_map
	The actual type depends on this tag value. More...

Additional Inherited Members
Public Attributes inherited from volatility.obj.CType
	members
	struct_size
Public Attributes inherited from volatility.obj.BaseObject
	obj_offset
	obj_vm

Member Function Documentation

def volatility.plugins.overlays.windows.vad_vtypes.VadTraverser.traverse	(		self,
			visited = None,
			depth = 0
	)

Traverse the VAD tree by generating all the left items, then the right items.

We try to be tolerant of cycles by storing all offsets visited.

Member Data Documentation

dictionary volatility.plugins.overlays.windows.vad_vtypes.VadTraverser.tag_map

static

Initial value:

= {'Vadl': '_MMVAD_LONG',
               'VadS': '_MMVAD_SHORT',
               'Vad ': '_MMVAD_LONG',
               'VadF': '_MMVAD_SHORT',
               'Vadm': '_MMVAD_LONG',
              }

The actual type depends on this tag value.

---

The documentation for this class was generated from the following file:

• volatility/plugins/overlays/windows/vad_vtypes.py